mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
change name from 'go-judger' to 'go-sandbox'
This commit is contained in:
parent
a115fc4321
commit
1ccd9f13f8
14
README.md
14
README.md
@ -1,12 +1,12 @@
|
||||
# go-judger
|
||||
# go-sandbox
|
||||
|
||||
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/seccomp/libseccomp-golang). As technology grows, it also implements new technologies such as Linux namespace & cgroup.
|
||||
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace & cgroup.
|
||||
|
||||
## Install
|
||||
|
||||
- install go compiler: `apt install golang-go`
|
||||
- install libseccomp-dev: `apt install libseccomp-dev`
|
||||
- install: `go install github.com/criyle/go-judger/...`
|
||||
- install: `go install github.com/criyle/go-sandbox/...`
|
||||
|
||||
## Technologies
|
||||
|
||||
@ -18,7 +18,7 @@ Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfle
|
||||
|
||||
Improvements:
|
||||
|
||||
1. Percise resource limits (s -> ms, mb -> kb)
|
||||
1. Precise resource limits (s -> ms, mb -> kb)
|
||||
2. More architectures (arm32, arm64, x86)
|
||||
3. Allow multiple traced programs in different threads
|
||||
4. Allow pipes as input / output files
|
||||
@ -63,7 +63,7 @@ Default file access syscall check:
|
||||
|
||||
- run_program: safely run program by unshare / ptrace / pre-forked containers
|
||||
|
||||
## Configuations
|
||||
## Configurations
|
||||
|
||||
- run_program/config.go: all configs toward running specs
|
||||
|
||||
@ -84,7 +84,7 @@ Pre-forked container also saves time for container creation / cleanup.
|
||||
$ go test -bench . -benchtime 10s
|
||||
goos: linux
|
||||
goarch: amd64
|
||||
pkg: github.com/criyle/go-judger/forkexec
|
||||
pkg: github.com/criyle/go-sandbox/forkexec
|
||||
BenchmarkSimpleFork-4 10000 1106064 ns/op
|
||||
BenchmarkUnsharePid-4 10000 1367824 ns/op
|
||||
BenchmarkUnshareUser-4 10000 1311523 ns/op
|
||||
@ -97,7 +97,7 @@ BenchmarkFastUnshareMountPivot-4 100 114364585 ns/op
|
||||
BenchmarkUnshareAll-4 100 851014031 ns/op
|
||||
BenchmarkUnshareMountPivot-4 20 901204445 ns/op
|
||||
PASS
|
||||
ok github.com/criyle/go-judger/forkexec 262.112s
|
||||
ok github.com/criyle/go-sandbox/forkexec 262.112s
|
||||
```
|
||||
|
||||
## TODO
|
||||
|
||||
@ -8,14 +8,14 @@ import (
|
||||
"os/signal"
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-judger/cgroup"
|
||||
"github.com/criyle/go-judger/deamon"
|
||||
"github.com/criyle/go-judger/memfd"
|
||||
"github.com/criyle/go-judger/runconfig"
|
||||
"github.com/criyle/go-judger/runprogram"
|
||||
"github.com/criyle/go-judger/rununshared"
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/cgroup"
|
||||
"github.com/criyle/go-sandbox/deamon"
|
||||
"github.com/criyle/go-sandbox/memfd"
|
||||
"github.com/criyle/go-sandbox/runconfig"
|
||||
"github.com/criyle/go-sandbox/runprogram"
|
||||
"github.com/criyle/go-sandbox/rununshared"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
const (
|
||||
|
||||
@ -8,9 +8,9 @@ import (
|
||||
"os"
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-judger/forkexec"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-judger/unixsocket"
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
)
|
||||
|
||||
// ContainerInit is called for container init process
|
||||
|
||||
@ -34,8 +34,8 @@ Any socket related error will cause the deamon exit (with all process inside con
|
||||
*/
|
||||
|
||||
import (
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
// Cmd is the control message send into deamon
|
||||
|
||||
@ -3,7 +3,7 @@ package deamon
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-judger/forkexec"
|
||||
"github.com/criyle/go-judger/memfd"
|
||||
"github.com/criyle/go-judger/unixsocket"
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/memfd"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-judger/unixsocket"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
)
|
||||
|
||||
// Ping send ping message to container
|
||||
|
||||
@ -3,9 +3,9 @@ package deamon
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-judger/unixsocket"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
)
|
||||
|
||||
// ExecveParam is parameters to run process inside container
|
||||
|
||||
@ -6,7 +6,7 @@ import (
|
||||
"syscall"
|
||||
"testing"
|
||||
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ package forkexec
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
)
|
||||
|
||||
// prepareExec prepares execve parameters
|
||||
|
||||
@ -5,8 +5,8 @@ package forkexec
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
)
|
||||
|
||||
// Runner is the RunProgramConfig including the exec path, argv
|
||||
|
||||
2
go.mod
2
go.mod
@ -1,4 +1,4 @@
|
||||
module github.com/criyle/go-judger
|
||||
module github.com/criyle/go-sandbox
|
||||
|
||||
go 1.12
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-judger/runprogram"
|
||||
"github.com/criyle/go-sandbox/runprogram"
|
||||
)
|
||||
|
||||
// Handler defines file access restricted handler to call the runprogram
|
||||
|
||||
@ -8,8 +8,8 @@ import (
|
||||
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
|
||||
"github.com/criyle/go-judger/tracer"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/tracer"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
type tracerHandler struct {
|
||||
|
||||
@ -3,8 +3,8 @@ package runprogram
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
// RunProgram defines the spec to run a program safely
|
||||
|
||||
@ -3,10 +3,10 @@ package runprogram
|
||||
import (
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
|
||||
"github.com/criyle/go-judger/forkexec"
|
||||
"github.com/criyle/go-judger/seccomp"
|
||||
"github.com/criyle/go-judger/tracer"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/seccomp"
|
||||
"github.com/criyle/go-sandbox/tracer"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
// Start starts the tracing process
|
||||
|
||||
@ -3,7 +3,7 @@ package rununshared
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
||||
@ -5,9 +5,9 @@ import (
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-judger/forkexec"
|
||||
"github.com/criyle/go-judger/seccomp"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/seccomp"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
package rununshared
|
||||
|
||||
import (
|
||||
"github.com/criyle/go-judger/types/mount"
|
||||
"github.com/criyle/go-judger/types/rlimit"
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
// RunUnshared runs program in unshared namespaces
|
||||
|
||||
@ -4,7 +4,7 @@ import (
|
||||
"runtime"
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-judger/types/specs"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
unix "golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user